expensive and consume significant management resources. In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our competitive position in the market.
If we are unable to recruit or retain skilled personnel, or if we lose the services of Michael J. Saylor, our business, operating results, and financial condition could be materially adversely affected
Our future success depends on our continuing ability to attract, train, assimilate, and retain highly skilled personnel. There has historically been significant competition for qualified employees across technology and other industries, and such competition may be further amplified by evolving restrictions on immigration, travel, or availability of visas for skilled workers. We may not be able to retain our current key employees or attract, train, assimilate, and retain other highly skilled personnel in the future, particularly at times when we undergo significant headcount reductions. Our future success also depends in large part on the continued service of Michael J. Saylor, our Chairman of the Board of Directors and Executive Chairman. If we were unable to attract, train, assimilate, and retain the highly skilled personnel we need, or we were to lose the services of Mr. Saylor, our business, operating results, and financial condition could be materially adversely affected. These risks may be exacerbated if a shareholder or a group of affiliated shareholders (other than or not including Mr. Saylor) were to exercise majority voting control of the Company.
Changes in laws or regulations relating to privacy or the collection, processing, disclosure, storage, localization, or transmission of personal data, or any actual or perceived failure by us or our third-party service providers to comply with such laws and regulations, contractual obligations, or applicable privacy policies, could materially adversely affect our business
Certain aspects of our business involve collecting, processing, disclosing, storing, and transmitting personal data, which are subject to certain privacy policies, contractual obligations, and U.S. and foreign laws, regulations, and directives relating to privacy and data protection. In addition, the types of data subject to protection as personal data in the European Union, China, the United States, and elsewhere have been expanding. In recent years, the collection and use of personal data by companies have come under increased regulatory and public scrutiny, especially in relation to the collection and processing of sensitive data, such as healthcare, biometric, genetic, financial services, and children’s data, precise location data, and data regarding a person’s race or ethnic origins, political opinions, or religious beliefs.
There are various enforcement agencies at both the state and federal level that review compliance with these requirements, including the United States Department of Health and Human Services for potential violations of the Health Insurance Portability and Accountability Act of 1996 and the Federal Trade Commission (“FTC”). If we are subject to a potential FTC enforcement action, we may be subject to a settlement order that requires us to adhere to very specific privacy and data security practices, which may impact our business. We may also be required to pay fines as part of a settlement (depending on the nature of the alleged violations). If we violate any consent order that we reach with the FTC, we may be subject to additional fines and compliance requirements. We face risks of similar enforcement from State Attorneys General and, potentially, other regulatory agencies.
Similar laws exist in other foreign jurisdictions, including the European Union, that may impact our business activities. In addition, various U.S. federal and state government agencies and foreign government bodies may enact new or additional laws or regulations, or issue rulings that invalidate prior laws or regulations, concerning privacy, data storage, data protection, and cross-border transfer of data that could materially adversely impact our business.
In addition to the provisions in certain international laws restricting the transfer of personal information to the United States, a new U.S. law also restricts the transfer of certain kinds of personal data in certain situations outside of the United States to “countries of concern,” including but not limited to China. On April 8, 2025, the U.S. Department of Justice’s National Security Division implemented the Data Security Program Rule under Executive Order 14117 and the International Emergency Economic Powers Act. This rule establishes restrictions on certain data-related transactions involving U.S. persons and entities, particularly those that may result in access to U.S. government-related data or bulk sensitive personal data of U.S. persons by foreign adversaries or entities under their control. The rule effectively imposes export control-like restrictions on the transfer, sale, or sharing of sensitive data—including genomic, geolocation, biometric, health, financial, and other personal data—to or with entities in countries of concern, as well as entities and persons associated with those countries. It also imposes additional due diligence obligations on U.S. companies concerning personal data they collect, store, or transmit. Failure to comply with the Data Security Program Rule could result in civil or criminal penalties, reputational harm, and restrictions on our ability to engage in certain business activities. Compliance may require us to modify our data handling practices, implement new controls, or terminate existing relationships with certain foreign vendors, customers, or partners. These changes could increase our operational costs, limit our market opportunities, and adversely affect our financial performance. Additionally, the scope and interpretation of the rule may evolve, and future guidance or enforcement actions could impose further obligations or restrictions.
Any systems failure or security breach that results in the release of, or unauthorized access to, personal data, or any failure or perceived failure by us or our third-party service providers to comply with applicable privacy policies, contractual obligations, or any applicable laws or regulations relating to privacy or data protection, could result in proceedings against us by domestic or foreign government entities or others, including private plaintiffs in litigation. Such proceedings could result in the imposition of sanctions, fines, penalties, liabilities, government orders, and/or orders requiring that we change our data practices, any of which could have a material adverse effect on our business, operating results, reputation, and financial condition.